Please do not report security problems in public issues.

Send an email to dotclear@jcdenis.fr with the module name, the Dotclear version and the steps to reproduce. You will get an answer as soon as possible.